A vulnerability has been found in itsourcecode Online Hotel Management System 1

CVE-2026-13554 is a reflected cross-site scripting flaw (CWE-79) in *itsourcecode Online Hotel Management System 1.0* — a free PHP/MySQL learning project distributed on itsourcecode.com and mirrored across student-tutorial sites. The unsanitized parameter lets an attacker craft a URL that, when clicked by a victim, executes attacker-controlled JavaScript in the victim's browser session. Only version 1.0 is named; the codebase has had no commercial maintenance and no semantic versioning beyond that tag.

Vendor-style MEDIUM (4.3) matches the textbook CVSS math for a reflected XSS with user interaction, but it materially overstates the real risk to any enterprise. This is throwaway tutorial code — it is not deployed on the kind of estate noisgate readers manage. The real story is fleet-relevance, not technical severity: if you own 10,000 hosts you almost certainly own zero copies of this app.

Why this verdict

• Reflected XSS with UI:R — attacker needs a logged-in victim to click a crafted URL; no drive-by, no pre-auth RCE.
• Tutorial-grade software — itsourcecode projects are learning artifacts; Shodan/Censys footprint is in the low double digits worldwide, none on enterprise ASNs.
• Role multiplier: the app is canonically a *low-value role* (student demo / localhost). There is no high-value-role deployment pattern — no IdP, no hypervisor, no CA, no backup server analog. Blast radius caps at one app origin even in the worst plausible deployment, so the role-multiplier floor does not apply.
• No vendor patch pipeline — but also no enterprise consumers waiting on one; the population that needs to act is essentially empty.
• Not KEV, EPSS expected <0.1% — no active exploitation signal.

Why not higher?

MEDIUM would imply this belongs in a regular patch cycle for the average enterprise. It does not — the affected software is not in any reasonable enterprise SBOM, and the bug requires user interaction with low integrity impact only. Upgrading on technical CVSS alone ignores fleet reality.

Why not lower?

IGNORE would be wrong if you actually run this app (a tiny number of hospitality students or micro-businesses might). For those operators the bug is real and exploitable, so LOW preserves the signal that it should be tracked and removed, just not on a sprint.

1. Inventory: confirm itsourcecode OHMS 1.0 is not in your estate — Run an SBOM / file-hash sweep for the project's distinctive PHP filenames (reservation.php, add_room.php) and the itsourcecode footer string. If you find zero hits — which is the expected outcome — you are done. No mitigation SLA applies (LOW); document the negative finding within your normal 365-day remediation window.
2. If found, retire the application — Replace with a maintained booking platform; itsourcecode ships no security updates. Treat as decommission, not patch, within the noisgate remediation SLA (≤ 365 days for LOW).
3. If retirement isn't immediate, front it with a WAF and force re-auth — Put any surviving instance behind ModSecurity CRS or Cloudflare with OWASP rules at paranoia 2+, set HttpOnly + SameSite=Lax on session cookies via a reverse proxy, and require SSO/MFA in front of the admin path.

Run on each web/app host you suspect might carry the itsourcecode codebase. Invoke as sudo ./check-cve-2026-13554.sh /var/www from an auditor workstation with read access, or directly on the host as root. Requires read access to webroots.

#!/usr/bin/env bash
# check-cve-2026-13554.sh
# Detects itsourcecode Online Hotel Management System 1.0 on disk.
# Usage: sudo ./check-cve-2026-13554.sh [webroot]
# Exit: 0 PATCHED/not present, 1 VULNERABLE, 2 UNKNOWN

set -u
ROOT="${1:-/var/www}"

if [ ! -d "$ROOT" ]; then
  echo "UNKNOWN: webroot $ROOT not found"
  exit 2
fi

# Signature: itsourcecode footer + characteristic filenames
HITS=$(grep -rIl --include='*.php' -E 'itsourcecode|Online Hotel Management System' "$ROOT" 2>/dev/null | head -n 5)
FILES=$(find "$ROOT" -type f \( -name 'add_room.php' -o -name 'reservation.php' -o -name 'room_list.php' \) 2>/dev/null | head -n 5)

if [ -n "$HITS" ] || [ -n "$FILES" ]; then
  echo "VULNERABLE: itsourcecode OHMS artifacts detected:"
  echo "$HITS"
  echo "$FILES"
  exit 1
fi

echo "PATCHED: no itsourcecode OHMS artifacts under $ROOT"
exit 0

Sources

1. NVD — CVE-2026-13554
2. MITRE CVE record
3. itsourcecode project page
4. CWE-79: Improper Neutralization of Input During Web Page Generation
5. OWASP Reflected XSS
6. CISA KEV catalog
7. FIRST EPSS
8. OWASP ModSecurity CRS